ENISA publishes first edition of Country Reports on Network and Information Security

The Country Reports are an assessment of the ongoing and planned activities of NIS in each of the 30 European countries covered. Each country chapter contains, among other sections: Country Highlights, Key Stakeholders Overview, Activities, and Current Trends (e.g. focusing on the status of national electronic ID schemes, and the major incidences of security breaches involving data loss).

The categorisation and mapping of stakeholders and their mutual relations was one of the main aims of the report. The most important areas in which national-level organisations have an impact on NIS were charted, namely: Policy Development (the drafting of, or assistance in the process of drafting, governmental policies relating to NIS); Policy Implementation; Privacy and Data Protection; Electronic Communications; Critical Infrastructure Protection / Critical Information Infrastructure Protection (CIP/CIIP); and Computer Emergency Response Team (CERTs).

The report found that institutions and responsibilities vary substantially from one country to another. However, some general trends were identified. These are as follows:

The most important actors for defining NIS policies are Governmental Organisations and Bodies: e.g. the Ministry of Communications, the National Regulatory Agency for Electronic Communications (where established), the National Office for Data Protection, the Ministries of Interior, Defence, or those having shared responsibilities for different areas of NIS.
Public Network and Information Security Bodies: Public NIS bodies with broad responsibilities exist in about one third of the countries. Their main tasks are, among others, information gathering for IT security issues and scientific advice. Many also approve and certify the security of national information systems.
CERTs: There are over 100 CERTs active in the EU, but their geographical distribution is very uneven. Almost all countries have 1 or 2 public sector CERTs. Most CERT act as the national NIS point of contact and coordinate crisis response

La Eurocámara pide que se refuerce la seguridad del comercio electrónico

El Pleno del Parlamento Europeo aprobó un informe en
el que se pide un refuerzo de la seguridad del comercio
electrónico, una simplificación de las normas que lo rigen
y medidas específicas para las Pymes.
En la actualidad, uno de cada tres ciudadanos europeos
compra por Internet, pero sólo 30 millones realizan compras
transfronterizas.
El informe, aprobado por 562 votos a favor, 9 en contra y
10 abstenciones, avisa de que la desconfianza sobre la
seguridad de las transacciones y de los pagos es el peligro
más grave para el futuro del comercio electrónico.
Por ello, los eurodiputados piden a la Comisión que establezca
mecanismos que refuercen la confianza en los
pagos electrónicos internacionales entre empresas y particulares
y que cree sistemas adecuados de resolución de
conflictos en caso de prácticas comerciales ilegales.
Se reitera la necesidad de establecer mecanismos para
adoptar las medidas de represión necesarias y coordinar
de manera más efectiva la lucha contra las conductas
ilegales que se dan actualmente en el comercio en línea,
con especial atención a los casos que pueden suponer un
grave riesgo para la salud pública, como la venta por Internet
de medicamentos falsos. También apuesta por una
mayor participación de los países en desarrollo en el comercio
internacional a través de Internet.

Impulsar el éxito Personas y Desarrollo Sostenible

La novedad de este documento es la utilización del enfoque de la sostenibilidad para maximizar el valor de la gestión de las personas y en la manera de proceder para implantar prácticas de desarrollo sostenible en las áreas clave de la empresa.

A través de once casos prácticos de estas empresas se muestran medidas pioneras aplicadas a la gestión de personas que no sólo contribuyen a aumentar el capital intelectual, si no también fortalecen la cultura corporativa y sentido de pertenencia, y ayudan a atraer y retener el talento. Por este motivo apoyan a los empleados y sus familias, trabajan por la estabilidad laboral en sus plantillas, apuestan por la igualdad de oportunidades, la gestión de competencias, la diversidad y la conciliación, sobre todo, se ocupan de que la empresa sea mejor y más competitiva.

Las empresas para ser competitivas y alcanzar el éxito pasa, hoy día, por invertir en las personas que forman la organización. Y que todo ello les da la oportunidad de asegurarse una plantilla comprometida e ilusionada que les permita ser, pensar y actuar con la sostenibilidad como referente. Además les facilitará enormemente todos los pasos que decida dar la dirección en materia de desarrollo sostenible.

transformación versus innovación

La innovación palpable hoy parece insuficiente tanto para resolver este problema
básico como para darle un nuevo dinamismo a las TIC. Pero eso no es lo más
grave. Podríamos estar en un momento más complicado (y no solamente por la
crisis financiera y económica) en el cual la innovación -motor esencial de las TICno
sea suficiente.
"La innovación murió en 2008" escribió el 31 de diciembre el columnista Bruce
Nussbaum. "La mataron la sobreexplotación, el uso a destiempo, la estrechez de
espíritu, el gradualismo y la incapacidad de evolucionar". La innovación, "reveló ser
débil como táctica y como estrategia frente a las turbulencias económicas y
sociales".
En su lugar propone el concepto de "transformación", una guía, según él, mucho
más útil para el futuro. "La innovación implica cambiar lo que está; la
transformación implica crear lo nuevo" (sic). Afirma que "nuestras vidas estarán
organizadas alrededor de plataformas digitales y de redes que sustituirán edificios y
grandes organizaciones, poniendo el acento sobre la gente diseñando redes y
sistemas en base a sus deseos y necesidades".
Estamos presenciando una desaceleración de las TIC que pasan de unos quince
años de revolución a una era de evolución más gradual en un momento en el cual
hace falta acelerar y cambiar de lógica. A los rigores de la crisis se agregan los
imperativos de las transformaciones. Sólo sobrevivirán las empresas capaces de
enfrentarse a la vez a ese doble obstáculo; pero otras nacerán.

El Proyecto SALA+ ofrece un servicio especial de búsqueda de socios en su

El Proyecto SALA+, con el objetivo de fomentar las cooperación entre Latinoamérica
y Europa a través de la cooperación en I+D en el área de las Tecnologías
Audiovisuales en Red (eNEM), ofrece un acceso gratuito on-line a una base de
datos que permite la identificación de socios potenciales, así como recibir
información puntual sobre oportunidades de participación en proyectos FP7,
Iberoeka, etc.
Esta base de datos on-line está disponible a través del siguiente link a “Partner
Search” de la página web del proyecto SALA+ (http://www.salamas.eu/ )
A través de dicho link los potenciales usuarios pueden:
• Registrarse gratuitamente y cumplimentar el perfil de la entidad a través del
cuestionario electrónico (5 minutos aprox.)
• Disponer de la lista actualizada con los perfiles de todas las entidades
registradas y hacer uso de ella, mediante la herramienta de búsqueda.
• Realizar búsquedas de socios on-line en esta base de datos para poder
identificar todas aquellas entidades que cumplan con las características
requeridas (tipo de entidad, país/región, áreas de interés…)
• Recibir periódicamente información relativa a oportunidades de colaboración en
propuestas de proyecto.
• Participar activamente en las actividades organizadas por el proyecto SALA+.
Por lo tanto, todas aquellas entidades interesadas, tanto Latinoamericanas como
Europeas, están invitadas a registrarse en la base de datos y participar activamente
en el lanzamiento de propuestas de proyectos de I+D en el ámbito de Tecnologías
audiovisuales en Red (eNEM).
Con este servicio gratuito, SALA+ espera que en un futuro próximo se puedan
establecer fructíferas colaboraciones entre entidades Europeas y Latinoamericanas.

EU/US: MEPSIR Study – Measuring European Public Sector Information Resources

This document is the final report of the MEPSIR study that conducted a measurement related to the European Directive 2003/98/EC of 17 November 2003 on the re-use of public sector information (PSI).

The first part of this report contains a description of the context (chapter 2) and the scope (chapter 3) of the study, followed by a description of the approach (chapter 4), methodology (chapter 5) and analysis method (chapter 6). This introductory material is followed by chapters with presentation of the overall results (chapter 7) and overviews of the results for all domains (chapter 8), for all countries (chapter 9) and for economic indicators (chapter 10). Chapter 11 describes the situation in the USA, while chapter 12 contains a description of seven case studies. The report concludes with a number of conclusions (chapter 13).

The second part of this report presents the detailed results of the study, both from a domain perspective, showing the figures for the sub-domains relevant for public sector information, as well as from a geographical perspective, showing the figures for the countries that were surveyed.

Original URL:
http://ec.europa.eu/information_society/policy/psi/library/index_en.htm

Number of pages:
Executive Summary of the MEPSIR Study: 20 pages
Part 1 of the final report of the MEPSIR Study: 94 pages
Part 2 of the final report of the MEPSIR Study – Detailed results for sub-domains and individual countries: 119 pages

jornada continua y flexible aumenta la producción y reduce el absentismo

Una jornada laboral compacta y con horario flexible tiene unos beneficios claros para las empresas que apuesten por esta fórmula: la productividad de los empleados aumenta entre un 15 y un 20% y se reduce su absentismo hasta en un 30%.



Así lo señaló recientemente la directora general de Igualdad de Oportunidades en el Trabajo de la Generalitat catalana, Sara Berbel, que participó en las Jornadas europeas ¿Hacia dónde va nuestro tiempo?.

A su juicio, un banco de horas dentro del horario laboral o el teletrabajo ayuda a mejorar el clima laboral. Berbel recalca que estas políticas no pueden ser cíclicas y depender de los vaivenes de la crisis -frente a la presión de las empresas de hacer trabajar más a sus empleados- y cree que se ha de luchar contra el prejuicio de que los horarios son "inamovibles".

Estas jornadas, promovidas por el Ayuntamiento de Barcelona, analizan los retos del uso social del tiempo e idean cómo hacer operativa una Red Europea de Ciudades de Usos del Tiempo, esto es, ciudades que se comprometan a promover la racionalización de horarios, informa EFE.

Racionalizar horarios como alternativa a los despidos

El ingeniero de la Universidad Politécnica de Catalunya (UPC), Jordi Ojeda, es coordinador de un grupo de investigadores que ha desarrollado un programa informático cuyo fin optimizar los tiempos -sobre todo en sectores como los servicios- para que los empleados puedan hacer horarios diferentes y los varíen según sus necesidades.

Ojeda, que presentó su programa capaz de realizar esta tarea en apenas, un minuto, apuntó, no obstante, la paradoja de que "a todos se nos llena la boca a la hora de hablar de conciliación, pero luego todos vamos al cine o a cenar fuera por la noche, o queremos que nos atiendan a las cuatro de la mañana si tenemos un accidente; el discurso no tiene que ser sólo el de conciliación, sino el de ofrecer servicios en condiciones para que el trabajador esté cómodo".

Además, con una buena organización del trabajo, se pueden reducir costos, "y algunas empresas no tendrían que echar a sus empleados en períodos de crisis", señaló ayer Ojeda, para quien la flexibilidad concertada es una de las vías de solución.

La doble presencia femenina

La profesora de Sociología de la Universidad Autónoma de Barcelona, Teresa Torns, expuso por su parte que no todo se circunscribe a la jornada laboral, sobre todo en el caso de las mujeres, ya que éstas mantienen una "doble presencia" por las tareas domésticas y de cuidado de los hijos y ancianos de las que se suelen encargar, una labor que "no tiene prestigio social y está invisibilizada". Por el contrario, lamentó que en el mercado laboral se mantenga el prestigio de la disponibilidad absoluta, una opción a las que muchas mujeres no pueden optar por sus "obligaciones".

An Introduction to the Business Model for Information Security

This introduction guide, with case study, is the first document in a series planned around the Business Model for Information Security. Based on the white paper “Systemic Security Management,” developed by the USC Marshall School of Business Institute for Critical Information Infrastructure Protection, this guide provides a starting point for discussion and future development. It defines the core concepts that will evolve into practical aids information security and business unit managers can use to align security program activities with organizational goals and priorities, effectively manage risk, and increase the value of information security program activities to the enterprise.

The Business Model for Information Security does not replace the many sources of security program best practices. It does, however, provide a view of information security program activities within the context the larger enterprise, to integrate the disparate security program components into a holistic system of information protection.

This guide introduces the model and its core concepts to enterprises, particularly to:
Senior executives
Information security managers
Those who have responsibility for managing business risk
Individuals who have responsibility for the design, implementation, monitoring and improvement of an information security management system

Enterprise Risk: Identify, Govern and Manage Risk The Risk IT Framework

This IT enterprise risk management framework was designed to allow business managers to identify and assess IT-related business risks and manage them effectively. It provides the missing link between enterprise risk management (ERM) and IT risk management and control, fitting in the overall IT governance framework of ITGI, and building upon all existing risk related components within the current frameworks, i.e., COBIT and Val IT.

The exposure draft is posted for 45 day public exposure and comment. At the conclusion of the exposure period, the authors will use the feedback, comments and suggestions provided to improve the publication for issue.

Any feedback and/or material ("Submitted Material") submitted by e-mail or otherwise to ISACA/ITGI regarding the exposure draft, will be considered non-confidential. ISACA/ITGI is free to use any Submitted Material incorporating it into subsequent drafts and the resulting published versions of the work. You hereby assign exclusively to ISACA/ITGI any and all of your rights, title and interest in and to the Submitted Material as it is incorporated into the work.

ENISA presents its first report on pan-European eIDM

On 29 January 2009, the EU Agency ENISA (the European Network and Information Security Agency) presented its first report on the current state of pan-European eID interoperability.


Europe has bold ambitions regarding interoperable eID services by the end of 2009. This report looks at how various initiatives such as the STORK project and the Services Directive could make eID work for business and government eServices across Europe.

Security and interoperability of eID systems across Europe is a current topic. European eID Management (eIDM) presently stands at crossroads. This is a vital and delicate stage, as pilot studies and models are now transformed into actual working systems.

ENISA calls its report a “milestone”, as it is the Agency’s first experts’ snapshot of Europe’s state of play in eIDM. The study charts the origins and scope of European eID interoperability. It focuses specifically on the triangle of three intrinsically connected drivers:

Policy level; an examination of the eID Roadmap and the eID -2010 goals to be reached by 2010.
The analysis of the recently initiated €20 million STORK Project. Among several EU projects focusing on eID, this initiative develops a series of pilot projects for citizens of 13 EU Member States, using their governments’ eID/authentication systems. Thus, the STORK project pilots a basic infrastructure in the EU for cross-border eID systems. But, the report strongly underlines that although STORK is significant, it is not to be seen as the panacea for all eID interoperability problems. Many European eIDM projects overlap but the solution does not lie in any single project. Instead the outcomes of all eID building blocks must eventually be put together to create a coherent and pragmatic infrastructure for European eID interoperability.
The implementation of the Services Directive. The Directive requires Member States to put electronic points of single contact in place by 28 December 2009. By then, service providers from any Member State should be able to complete formalities, to offer their services and to identify themselves electronically in a reliable way.
The report identified the following four main policy priorities for European eIDM:

In 2009, the policy objectives of the eID Roadmap will need to be reviewed and updated.
The results of the STORK project and how the pilot infrastructure can be expanded into a full-scale system, will need to be examined.
Once an interoperability infrastructure is in place, Member States will need to decide on the security requirements of their applications which do not discriminate against foreign citizens and enterprises.
Greater emphasis will need to be given on the citizen-centric approach to eID. It is crucial to give users sufficient personal control over their identity.
Mr. Andrea Pirotti, Executive Director of ENISA commented:

“This report shows that the pioneer eID systems soon must move into interoperable systems. This is a crucial time for EU Member States to make the right decisions, not only to guarantee interoperability, but also security and usability.”

Further information:

Source press release – ENISA
ePractice Library – i2010 eIDM Roadmap
Website of the STORK Project
ePractice Library – Directive on services in the internal market
ePractice Library – ENISA Report on the state of pan-European eIDM initiatives and FAQs of the report

PenalNet: secure e-communication in Criminal Law Practice

PenalNet is a web platform which will supply a secure network of communication between EU criminal lawyers. The project objective is to develop better communications and strengthen the cross-border confidence of the practitioners. PenalNet provides the security that a lawyer is actually dealing with the wanted colleague, and that the latter is the only entitled to access the content received. Likewise, the system guarantees that the information exchanged cannot be modified or rejected. Communication is encrypted (SSL protocol) between lawyers, always including a time-stamping attested by ‘PenalNet’. Among other functionalities, PenalNet contains a directory of criminal lawyers who are registered at the platform by means of their professional digital certificate, which enables secure online identification and signature. It also allows secure email and document delivery through digital signature, acknowledgment of receipt provided by the platform, acknowledgement of reading and sms alert. All in all, using PenalNet will imply a notable decrease of burocratical delays, allow faster interaction and efficiency, and increase confidence between the professionals and amongst clients/citizens whilst protecting their right to privacy. It will also help to promote a culture of safe communications and closer cooperation at European level which, at present, are at an initial stage. PenalNet is being implemented as a pilot project in five Member States: Spain, France, Italy, Hungary and Romania, each of them putting together 300 tester lawyers. From 2010 onwards, PenalNet aims to become a permanent service provided for every EU qualified lawyer

New IBM Consulting Service Finds Savings Throughout Supply

23 January 2009 - At one time, Chinese shipping and logistics company Cosco had 100 distribution centers. Turn's out, the company really only needed less than half of them.

With the help of IBM's new supply chain consulting service, Cosco figured out it could reduce its number of distribution centers from 100 to only 40 while maintaining the same level of service to its customers.

IBM's service, Supply Chain Network Optimization Workbench (SNOW), takes a look at the entirety of a company's supply chain, and can help analyze five logistics areas: materials for products, sourcing and suppliers, manufacturing and production processes, warehousing, and transportation and distribution.

In the case of distribution centers, it can look at where a company's centers are, look at where it's customers are and create alternative set-ups and scenarios that would lower costs and cut energy and fuel use.

In Cosco's case, the company lowered its logistics costs 23 percent and cut carbon dioxide emissions by 15 percent, or about 100,000 tons per year.

"The main thing is, it gave them a way to look holistically at the placement and utilization of their centers,” said Eric Riddleberger, IBM's global leader for business strategy consulting. "Especially with companies that grow quickly, you build distribution centers based on where there is demand. This is a chance to step back and say, ‘What should our distribution centers be like, where should they be?'”

IBM works with companies to use the service and understand the impacts of alternatives. The service is also designed to help companies find alternate transportation routes to reduce fuel and trucking miles, and to analyze the trade-offs of sourcing from different suppliers.

How often a company will have to use the tool to look at its operations will depend on its situation. "You're not going to make changes in distribution centers or sourcing or production on a continuous basis, but it is the kind of thing that you want to see them working on a semi-annual or annual basis," Riddleberger said. Companies expanding quickly might want to do it more often; companies that are fairly stable would have to do it less frequently.

This article is reproduced with kind permission of GreenBiz.com.